@memnexus-ai/mx-agent-cli 0.1.196 → 0.1.197

package/dist/__tests__/config-mirror-integrity.test.js

@@ -161,10 +161,17 @@ const MIRROR_PAIRS = [
         '.claude/hooks/coordination-brief.test.sh',
         'mx-agent-system/agent-config/hooks/coordination-brief.test.sh',
     ],
-    // NOTE: agent-config/settings.json is intentionally NOT a mirror pair — the
-    // worktree .claude/settings.json is COMPOSED/merged from the source, not a
-    // byte-identical copy, so its SessionStart wiring is verified by composition,
-    // not byte-identity.
+    // NOTE: agent-config/settings.json is intentionally NOT a byte-identity mirror
+    // pair — the worktree .claude/settings.json has its SessionStart/hook wiring
+    // COMPOSED/merged from the source at deploy time (see claude.ts), so the two
+    // are not byte-identical by design. But the SECURITY-SENSITIVE part — the
+    // `permissions` allow/deny/ask lists and the experimental-teams flag — must
+    // never drift, because config-sync/`mx-agent new` ship agent-config's copy
+    // into worktrees verbatim. A prior drift (agent-config/settings.json lagged
+    // active by the "Monitor" allow entry from #4275, and the git-mutation-guard
+    // #4289 hardening) shipped a weakened config to consumer worktrees (#4294).
+    // The `settings.json permissions parity` describe below guards that surface
+    // semantically rather than by byte-identity.
 ];
 describe('config mirror integrity', () => {
     for (const [claudeRel, agentConfigRel] of MIRROR_PAIRS) {
@@ -183,4 +190,43 @@ describe('config mirror integrity', () => {
         });
     }
 });
+/**
+ * settings.json is composed (SessionStart/hook wiring is merged into the worktree
+ * copy at deploy time), so it is not a byte-identity mirror pair above. But its
+ * `permissions` block and the experimental-teams flag are shipped verbatim into
+ * consumer worktrees by config-sync/`mx-agent new`; drift there ships a weakened
+ * security posture. This suite asserts semantic parity of exactly those fields
+ * between the active runtime copy and the agent-config source of truth so a
+ * regression like #4294 (agent-config lagging the active allow-list) fails
+ * locally before it ships.
+ */
+describe('settings.json permissions parity', () => {
+    const claudeSettingsAbs = join(REPO_ROOT, '.claude/settings.json');
+    const agentConfigSettingsAbs = join(REPO_ROOT, 'mx-agent-system/agent-config/settings.json');
+    const bothPresent = existsSync(claudeSettingsAbs) && existsSync(agentConfigSettingsAbs);
+    const loadPerms = (abs) => {
+        const parsed = JSON.parse(readFileSync(abs, 'utf-8'));
+        return parsed;
+    };
+    (bothPresent ? it : it.skip)('permissions.allow is identical between active and agent-config', () => {
+        const active = loadPerms(claudeSettingsAbs);
+        const template = loadPerms(agentConfigSettingsAbs);
+        expect(template.permissions?.allow).toEqual(active.permissions?.allow);
+    });
+    (bothPresent ? it : it.skip)('permissions.deny is identical between active and agent-config', () => {
+        const active = loadPerms(claudeSettingsAbs);
+        const template = loadPerms(agentConfigSettingsAbs);
+        expect(template.permissions?.deny).toEqual(active.permissions?.deny);
+    });
+    (bothPresent ? it : it.skip)('permissions.ask is identical between active and agent-config', () => {
+        const active = loadPerms(claudeSettingsAbs);
+        const template = loadPerms(agentConfigSettingsAbs);
+        expect(template.permissions?.ask).toEqual(active.permissions?.ask);
+    });
+    (bothPresent ? it : it.skip)('CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS flag is identical between active and agent-config', () => {
+        const active = loadPerms(claudeSettingsAbs);
+        const template = loadPerms(agentConfigSettingsAbs);
+        expect(template.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS).toEqual(active.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS);
+    });
+});
 //# sourceMappingURL=config-mirror-integrity.test.js.map

package/dist/__tests__/config-mirror-integrity.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-mirror-integrity.test.js","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,YAAY,GAA6C;IAC7D;QACE,+CAA+C;QAC/C,oEAAoE;KACrE;IACD;QACE,oDAAoD;QACpD,yEAAyE;KAC1E;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,oCAAoC;QACpC,yDAAyD;KAC1D;IACD;QACE,gCAAgC;QAChC,qDAAqD;KACtD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E;QACE,uCAAuC;QACvC,4DAA4D;KAC7D;IACD;QACE,iCAAiC;QACjC,sDAAsD;KACvD;IACD;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD;QACE,gDAAgD;QAChD,qEAAqE;KACtE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD;QACE,8BAA8B;QAC9B,mDAAmD;KACpD;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE;QACE,kCAAkC;QAClC,uDAAuD;KACxD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,wCAAwC;QACxC,6DAA6D;KAC9D;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wCAAwC;IACxC;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yDAAyD;IACzD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,qBAAqB;CACtB,CAAC;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEvD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,MAAM,cAAc,cAAc,SAAS,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QAED,EAAE,CAAC,GAAG,SAAS,yBAAyB,cAAc,EAAE,EAAE,GAAG,EAAE;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"config-mirror-integrity.test.js","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,YAAY,GAA6C;IAC7D;QACE,+CAA+C;QAC/C,oEAAoE;KACrE;IACD;QACE,oDAAoD;QACpD,yEAAyE;KAC1E;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,oCAAoC;QACpC,yDAAyD;KAC1D;IACD;QACE,gCAAgC;QAChC,qDAAqD;KACtD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E;QACE,uCAAuC;QACvC,4DAA4D;KAC7D;IACD;QACE,iCAAiC;QACjC,sDAAsD;KACvD;IACD;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD;QACE,gDAAgD;QAChD,qEAAqE;KACtE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD;QACE,8BAA8B;QAC9B,mDAAmD;KACpD;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE;QACE,kCAAkC;QAClC,uDAAuD;KACxD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,wCAAwC;QACxC,6DAA6D;KAC9D;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wCAAwC;IACxC;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yDAAyD;IACzD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6CAA6C;CAC9C,CAAC;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEvD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,MAAM,cAAc,cAAc,SAAS,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QAED,EAAE,CAAC,GAAG,SAAS,yBAAyB,cAAc,EAAE,EAAE,GAAG,EAAE;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACnE,MAAM,sBAAsB,GAAG,IAAI,CACjC,SAAS,EACT,4CAA4C,CAC7C,CAAC;IAEF,MAAM,WAAW,GACf,UAAU,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAGnD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,gEAAgE,EAChE,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,+DAA+D,EAC/D,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,8DAA8D,EAC9D,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,wFAAwF,EACxF,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAC3D,MAAM,CAAC,oCAAoC,CAC5C,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/agent-config/.mx-config-generation.json

@@ -1,4 +1,4 @@
 {
-  "generation": 1,
+  "generation": 2,
   "description": "Monotonic agent-config generation. Bump when shipping agent-config changes that external projects should pull via `mx-agent config-sync`. The CLI stamps this into a project's config on init/config-sync and warns on `mx-agent start` when a project's generation is older than the CLI's bundled generation. Platform v2.35 Phase 3 (#4017)."
 }

package/dist/agent-config/hooks/git-mutation-guard.sh

@@ -41,17 +41,15 @@
 # (bash/sh/zsh/dash/ksh/eval/source/`.`) or pipes the body into one (`| ...sh`)
 # is KEPT and still scanned, because those bodies ARE executed and a destructive
 # git verb in them is real (e.g. `bash <<EOF ... git reset --hard ... EOF`).
-# KNOWN FALSE-POSITIVE CLASS (accepted friction, fails safe, GIT_EXPERT=1 clears
-# it): a blocked git verb quoted on a command line — e.g. `echo "run git reset
-# --hard"`, or a `gh issue create --body "... git reset --hard && git stash drop
-# ..."` filing whose body mentions destructive git after a separator — still
-# matches and still blocks. Quoted content is scanned as-is: fixing this without
-# opening a bypass proved harder than the fix was worth. A quote-stripping pass
-# (item 4, #3934) was built and CUT after two adversarial security reviews found
-# fail-open regressions (executor-payload blanking; per-line sink scoping that
-# allowed `echo "hi" && ssh h 'git reset --hard'`); the redesign is tracked
-# separately. WORKAROUND for the issue/PR-body case: pass the prose via
-# `--body-file <path>` instead of an inline `--body "..."`. Known bypass classes
+# QUOTED-CONTENT HANDLING (per-segment sink scoping, #3938): commands whose
+# quoted text merely MENTIONS destructive git verbs (e.g. `echo "run git reset
+# --hard"`, `gh issue create --body "... git stash ..."`) are correctly allowed.
+# Sink commands (echo, printf, gh --body, git commit -m, etc.) have their quoted
+# content blanked before scanning. Executor commands (bash, ssh, su, etc.) have
+# their quoted content extracted and scanned as separate segments — their args
+# are commands, not data. Pipe chains propagate executor status backwards, so
+# `echo "git reset --hard" | bash` is still blocked. Unknown commands keep
+# quotes intact (fail safe = blocked if a pattern matches). Known bypass classes
 # (out of scope, NOT defended): indirection via a script file, shell
 # variable/`eval` assembly, or an alias can run a blocked op without a literal
 # match. The guard deters accidental discards; it does not stop a determined
@@ -110,6 +108,144 @@ strip_heredocs() {
   '
 }
 
+# --- per-segment sink-scoped quote handling (#3938) ---------------------------
+# Sink commands (echo, printf, gh --body, git commit -m, etc.) have their
+# quoted content blanked so prose mentioning destructive git verbs doesn't
+# false-positive. Executor commands (bash, ssh, su, etc.) have their quoted
+# content EXTRACTED and emitted as additional segments for scanning (their
+# quoted args are commands, not data). Per-segment scoping prevents the
+# round-2 bypass where a sink on one segment blanked an executor's payload
+# on the next. Pipe chains propagate executor status backwards: if stage N
+# is an executor and connected by pipe to stage N-1, stage N-1's quotes
+# are not blanked (its output feeds the executor). Fail-safe: unknown
+# commands keep quotes intact (no blanking, no extraction).
+strip_sink_quotes() {
+  awk '
+function get_lead_cmd(seg,    s) {
+    s = seg; gsub(/^[[:space:]]+/, "", s)
+    while (match(s, /^[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+/))
+        s = substr(s, RSTART + RLENGTH)
+    while (match(s, /^[0-9]*[<>][>&]?[^[:space:]]*[[:space:]]+/))
+        s = substr(s, RSTART + RLENGTH)
+    if (match(s, /^[^[:space:]]+/)) return substr(s, RSTART, RLENGTH)
+    return ""
+}
+function is_exec(cmd) {
+    return (cmd == "bash" || cmd == "sh" || cmd == "zsh" || cmd == "dash" || \
+            cmd == "ksh" || cmd == "eval" || cmd == "source" || cmd == "ssh" || \
+            cmd == "su" || cmd == "doas" || cmd == "nsenter" || \
+            cmd == "sudo" || cmd == "xargs")
+}
+function check_sink(seg,    cmd, s, sc) {
+    cmd = get_lead_cmd(seg)
+    if (is_exec(cmd)) return 0
+    if (cmd == "echo" || cmd == "printf" || cmd == "cat" || cmd == "tee" || cmd == "write")
+        return 1
+    if (cmd == "gh" && (seg ~ /--body/ || seg ~ /--title/ || seg ~ /--comment/))
+        return 1
+    if (cmd == "git") {
+        s = seg; gsub(/^[[:space:]]+/, "", s); sub(/^git[[:space:]]+/, "", s)
+        while (match(s, /^(-C[[:space:]]+[^[:space:]]+|-c[[:space:]]+[^[:space:]]+|--[a-z][-a-z0-9]*(=[^[:space:]]*)?)[[:space:]]+/))
+            s = substr(s, RSTART + RLENGTH)
+        if (match(s, /^[^[:space:]]+/)) {
+            sc = substr(s, RSTART, RLENGTH)
+            if ((sc == "commit" || sc == "tag" || sc == "notes") && \
+                (seg ~ /-[a-zA-Z]*m[[:space:]]/ || seg ~ /--message/))
+                return 1
+        }
+    }
+    return 0
+}
+function blank_quotes(seg,    n, i, c, out, isq, idq) {
+    n = length(seg); out = ""; isq = 0; idq = 0
+    for (i = 1; i <= n; i++) {
+        c = substr(seg, i, 1)
+        if (isq) {
+            if (c == "'"'"'") { isq = 0; out = out c } else out = out " "
+            continue
+        }
+        if (idq) {
+            if (c == "\\") { out = out "  "; i++; continue }
+            if (c == "\"") { idq = 0; out = out c } else out = out " "
+            continue
+        }
+        if (c == "'"'"'") { isq = 1; out = out c; continue }
+        if (c == "\"") { idq = 1; out = out c; continue }
+        out = out c
+    }
+    return out
+}
+function extract_quotes(seg,    n, i, c, ct, isq, idq, res) {
+    n = length(seg); isq = 0; idq = 0; ct = ""; res = ""
+    for (i = 1; i <= n; i++) {
+        c = substr(seg, i, 1)
+        if (isq) {
+            if (c == "'"'"'") {
+                isq = 0
+                if (ct != "") { if (res != "") res = res "\n"; res = res ct }
+                ct = ""
+            } else ct = ct c
+            continue
+        }
+        if (idq) {
+            if (c == "\\") { ct = ct substr(seg, i+1, 1); i++; continue }
+            if (c == "\"") {
+                idq = 0
+                if (ct != "") { if (res != "") res = res "\n"; res = res ct }
+                ct = ""
+            } else ct = ct c
+            continue
+        }
+        if (c == "'"'"'") { isq = 1; continue }
+        if (c == "\"") { idq = 1; continue }
+    }
+    return res
+}
+{
+    line = $0; n = length(line)
+    isq = 0; idq = 0; num = 0; seg_s = 1
+    for (i = 1; i <= n; i++) {
+        c = substr(line, i, 1)
+        if (isq) { if (c == "'"'"'") isq = 0; continue }
+        if (idq) { if (c == "\\") { i++; continue }; if (c == "\"") idq = 0; continue }
+        if (c == "'"'"'") { isq = 1; continue }
+        if (c == "\"") { idq = 1; continue }
+        sp = 0; sl = 1; st = ""
+        if (c == ";") { sp = 1; st = "seq" }
+        else if (c == "&" && i < n && substr(line, i+1, 1) == "&") { sp = 1; sl = 2; st = "seq" }
+        else if (c == "|" && i < n && substr(line, i+1, 1) == "|") { sp = 1; sl = 2; st = "seq" }
+        else if (c == "|") { sp = 1; st = "pipe" }
+        if (sp) {
+            num++; segs[num] = substr(line, seg_s, i - seg_s); stypes[num] = st
+            seg_s = i + sl; if (sl == 2) i++
+        }
+    }
+    num++; segs[num] = substr(line, seg_s); stypes[num] = ""
+    # classify each segment
+    for (s = 1; s <= num; s++) { snk[s] = check_sink(segs[s]); pxe[s] = 0 }
+    # backward-propagate executor status through pipes
+    for (s = num; s >= 2; s--) {
+        if (stypes[s-1] == "pipe") {
+            cmd = get_lead_cmd(segs[s])
+            if (is_exec(cmd) || pxe[s]) { snk[s-1] = 0; pxe[s-1] = 1 }
+        }
+    }
+    # emit processed segments
+    for (s = 1; s <= num; s++) {
+        if (snk[s]) { print blank_quotes(segs[s]) }
+        else {
+            print segs[s]
+            cmd = get_lead_cmd(segs[s])
+            if (is_exec(cmd) || pxe[s]) {
+                ex = extract_quotes(segs[s])
+                if (ex != "") print ex
+            }
+        }
+    }
+}
+  '
+}
+
 SCAN=$(printf '%s' "$COMMAND" | strip_heredocs)
 
 refuse() {
@@ -161,21 +297,19 @@ refuse() {
 # mx-guard-hook.sh. Applied per-segment to the heredoc- and quote-stripped SCAN.
 # GIT_EXPERT=1 clears any accepted false positive. `echo` is deliberately NOT a
 # wrapper word, so `echo "use timeout 5 git reset --hard"` stays allowed.
-GITSEG='(^|[;&|({]|\s(then|do|else)\s)\s*([0-9]*[<>][^[:space:]]*\s+|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*\s+|(sudo|env|nice|nohup|time|timeout|ionice|stdbuf|command|xargs|setsid)\s+([0-9]+\s+)?)*git(\s+(-C\s+[^[:space:];&|]+|-c\s+[^[:space:];&|]+|--(git-dir|work-tree|namespace|super-prefix)(=[^[:space:];&|]*|\s+[^[:space:];&|]+)|--[A-Za-z][A-Za-z0-9-]*=[^[:space:];&|]*|--[A-Za-z][A-Za-z0-9-]*|-[A-Za-z]))*\s+'
+GITSEG='(^|[;&|({`]|\s(then|do|else)\s)\s*([0-9]*[<>][^[:space:]]*\s+|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*\s+|(sudo|env|nice|nohup|time|timeout|ionice|stdbuf|command|xargs|setsid|doas|nsenter)\s+([0-9]+\s+)?)*git(\s+(-C\s+[^[:space:];&|]+|-c\s+[^[:space:];&|]+|--(git-dir|work-tree|namespace|super-prefix)(=[^[:space:];&|]*|\s+[^[:space:];&|]+)|--[A-Za-z][A-Za-z0-9-]*=[^[:space:];&|]*|--[A-Za-z][A-Za-z0-9-]*|-[A-Za-z]))*\s+'
 
-# --- per-segment evaluation (item 3, #3934) ---------------------------------
+# --- per-segment evaluation (item 3, #3934; sink scoping, #3938) --------------
 # Each allow-check (stash list|show; restore --staged-without-worktree) must be
 # scoped to the SAME command segment as the mutating verb it whitelists.
 # Whole-command allow-checks let a read-only first segment green-light a
 # destructive second one: `git stash list && git stash drop` or
 # `git restore --staged f && git restore f` slipped through because the
-# allow-form matched elsewhere on the line. Split SCAN on the shell separators
-# `;` `&` `|` and newlines (heredoc bodies were already emitted line-per-line by
-# strip_heredocs) and run the full verb logic on each segment independently.
-# `&&`/`||` collapse to empty segments (skipped). refuse() exits, so the first
-# offending segment blocks. NOTE: a separator inside a quoted string still
-# splits here (quoted content is scanned as-is — see the KNOWN FALSE-POSITIVE
-# CLASS note in the header); that fails safe (blocks), which is intentional.
+# allow-form matched elsewhere on the line. strip_sink_quotes splits SCAN on
+# unquoted shell separators (`;` `&&` `||` `|`), blanks quoted content in sink
+# segments, extracts quoted content from executor segments as additional lines,
+# and emits one segment per line. refuse() exits, so the first offending
+# segment blocks.
 check_segment() {
   local seg="$1"
 
@@ -214,6 +348,6 @@ check_segment() {
 while IFS= read -r _seg; do
   [[ -n "$_seg" ]] || continue
   check_segment "$_seg"
-done < <(printf '%s\n' "$SCAN" | tr ';&|' '\n')
+done < <(printf '%s\n' "$SCAN" | strip_sink_quotes)
 
 exit 0

package/dist/agent-config/settings.json

@@ -136,7 +136,8 @@
       "WebFetch",
       "WebSearch",
       "Task",
-      "NotebookEdit"
+      "NotebookEdit",
+      "Monitor"
     ],
     "deny": [
       "Bash(rm -rf /*)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memnexus-ai/mx-agent-cli",
-  "version": "0.1.196",
+  "version": "0.1.197",
   "description": "CLI for creating and managing AI agent teams",
   "type": "module",
   "bin": {